AI Pentesting Agent Discovers Critical OTP Bypass Vulnerability in Production System

An AI pentesting agent identified a critical authentication bypass vulnerability in a major insurer's production system, where users could redirect one-time passcodes. Proving the exploit on a live website posed significant challenges despite the simplicity of the initial flaw.

The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part.

TL;DR

During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it

Read original article